A dynamic trapping system and method based on distributed collaboration

Abstract

The application provides a dynamic trapping system and method based on distributed cooperation, breaks the defect of high coupling between a traditional honeypot bait unit and a data capture unit, solves the disadvantage that the traditional honeypot cannot actively trap high-quality attack data, and the basic idea is that the bait unit and the data capture unit of the traditional honeypot are decoupled, and the decoupled bait unit and the data capture unit are cooperatively scheduled and managed by introducing a resource management unit. The decoupled bait unit can deploy a certain number of security protection facilities while deploying the bait to improve the authenticity of the bait. The decoupled data capture unit deploys more refined data collection, data control and data analysis modules. In addition, the decoupled bait unit and the data capture unit can be independently deployed and updated, and can be flexibly combined according to different scenes, so that malicious attack log collection is effectively realized, and the sensitivity, countermeasures, concealment and dynamics of the dynamic trapping system are met.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a dynamic trapping system and method based on distributed collaboration. Background Technology

[0002] Since its inception, the internet has been threatened by cyberattacks and malicious code. With the continuous development of attack techniques, new forms of security threats emerge and evolve, while defense technologies cannot keep pace with these changes, leading to a deteriorating internet security situation. At its root, an asymmetrical technological game exists between attackers and defenders: attackers only need to find a single vulnerability in a target system to breach it, while defenders must ensure their systems are free of exploitable vulnerabilities and possess 24 / 7 monitoring mechanisms to guarantee security. Attackers can utilize scanning, sniffing, and other techniques to comprehensively gather information about their targets, while defenders, even after being compromised, often struggle to ascertain the source, method, and motive of the attack. If this game fails, due to a lack of security response technologies and coordination mechanisms, attackers often suffer no losses, while defenders typically face the risk of system and information damage or theft.

[0003] To bridge the information asymmetry gap between attackers and defenders, security experts have proposed honeypot-based security protection technology. This is a proactive defense technology developed by the defender to reverse this asymmetry. A honeypot is defined as a type of security resource with no business purpose; its value lies solely in attracting attackers to use it illegally. Essentially, honeypot technology is a technique that deceives attackers. By deploying decoy hosts, network services, or information, attackers are lured to attack these decoys. This allows for the capture and analysis of attack behavior, understanding the tools and methods used by the attackers, and inferring their intentions and motives. It enables defenders to clearly understand the security threats they face and enhance the security capabilities of their systems through technical and management measures. In recent years, numerous security protection methods and patents based on honeypot technology have been proposed.

[0004] Chinese patent application CN101185063A discloses a system and method for detecting and blocking attacks using honeypots. According to certain embodiments of the invention, it provides a system and method for protecting applications from attacks. In some instances of the invention, an anomaly detection component receives packets from a communication network. The anomaly detection component monitors the received packets and routes the communication to a protected application or to a honeypot, where the honeypot shares all state information with the protected application. If the received communication is routed to the honeypot, the honeypot monitors the communication to detect attacks. If an attack occurs, the honeypot repairs the protected application. However, the honeypot system of this patent invention is not isolated from the real physical network, making it easy for attackers to use the honeypot as a springboard to compromise the real physical network.

[0005] Chinese patent application CN107819731A discloses a network security protection system and related methods. The network security protection system includes at least one boundary honeypot and a honeynet connected to the at least one boundary honeypot; wherein the at least one boundary honeypot is located in the business network, and the at least one honeynet is isolated from the business network; the at least one boundary honeypot is used to induce an attacker to attack itself and guide the attacker into the connected honeynet. This invention induces attackers to attack the boundary honeypot and further guides them into the honeynet. Because the honeynet is isolated from the business network, compared with existing technologies, it can induce and deceive attackers through the boundary honeypot and honeynet, achieving more effective defense against both known and unknown attack methods. It also delays the attacker's attack time, changes the attacker's attack path, and thus promptly blocks the attacker's attack on the normal business network. However, this invention can only simply reply to the attacker's request messages, and the honeypot's camouflage is poor, making it easy for attackers to identify the honeypot's response behavior.

[0006] Chinese patent application CN202010805588.3 discloses a high-interaction honeypot system and a honeypot protection method. The high-interaction honeypot system includes a honeypot service module and a proxy module. The honeypot service module is located in a container and / or virtual machine and provides honeypot services. The honeypot service module and the proxy module are isolated from each other. The proxy module includes a message transmission port, a parser, and an encoder, all coupled sequentially. The parser and encoder are both coupled to the honeypot service module. The message transmission port transmits messages between the client and the honeypot service module. The parser parses the messages according to a preset parsing format, and the encoder encodes the parsed messages according to a preset encoding format. The messages include a request message sent to the honeypot service module and a response message sent to the client. This patent's design features a highly coupled decoy management unit and data capture unit, resulting in low deception and a lack of deception.

[0007] In summary, while current honeypot systems play an important role in proactive security defense, they still have the following drawbacks.

[0008] First, honeypot systems still cannot effectively resolve the contradiction between simulation and controllability: while highly interactive honeypots that adopt an environment consistent with the business system have a high degree of camouflage and deception, they are insufficient in terms of the granularity and completeness of attack behavior monitoring, as well as the cost and consequences of environment maintenance; on the other hand, low-interactive honeypot technology, which has high controllability and low maintenance costs, often has insufficient simulation, especially in the inability to capture new attack threats, and is relatively easy to identify.

[0009] Second, existing honeypot technologies primarily target traditional, widespread security threats with a large-scale impact. Their deception and monitoring capabilities are insufficient for targeted advanced persistent threats (APS). Honeypot technologies designed to address APS must be highly customizable and adaptable to dynamic environments, while also possessing high stealth capabilities, integrating seamlessly into actual business systems to avoid easy detection.

[0010] Third, most existing honeypot systems encapsulate the decoy management unit and data capture unit together as containers or components, resulting in extremely high coupling. Furthermore, this coupled honeypot design makes it difficult to deploy sufficient security software within the decoy management unit to enhance the system's deceptiveness. In addition, the coupled decoy management unit and data capture unit cannot be deployed and updated independently, making deployment and management more challenging. Summary of the Invention

[0011] The purpose of this invention is to overcome the shortcomings of existing technologies and break through the high coupling between the bait management unit and data capture unit in traditional honeypot systems. It proposes a dynamic trapping system and method based on distributed collaboration. The basic idea is to decouple the bait management unit and data capture unit of a traditional honeypot, and introduce a resource management unit to coordinate and manage the decoupled bait management unit and data capture unit. The decoupled bait management unit can deploy a certain number of security protection facilities simultaneously with the bait deployment to improve the bait's realism and more effectively deceive attackers. The decoupled data capture unit deploys more refined data acquisition, data control, and data analysis functions to achieve real-time data analysis. Furthermore, each decoupled unit can be deployed and updated independently, and can be flexibly combined according to different scenarios and methods to effectively achieve comprehensive malicious attack log collection, meeting the sensitivity, countermeasures, and stealth requirements of dynamic trapping systems.

[0012] To achieve the above-mentioned objectives, the technical solution provided by this invention is as follows:

[0013] A dynamic trapping system based on distributed collaboration is characterized by comprising: a bait management unit, a capture management unit, a coordinator unit, a data capture unit, a data control unit, and a data analysis unit.

[0014] The coordinator unit is used to configure and manage the decoy management unit and the capture management unit, and to monitor and manage their operational status in real time. The decoy management unit is responsible for configuring relevant information of the decoy nodes and managing the operational status of all decoy nodes. The capture management unit is responsible for coordinating and managing the collaborative work of the data control unit, the data capture unit, and the data analysis unit. The data control unit is responsible for classifying attack traffic data, forwarding attack traffic data that is not of interest to the dynamic trapping system to low-interaction honeypots, and redirecting attack traffic that is of interest to the dynamic trapping system to specific high-interaction honeypots. The data capture unit captures all attack events, system logs, and malicious behavior data of the honeypot system. The data analysis unit uses deep learning, graph neural networks, and other technologies and models to perform in-depth analysis and mining of the collected attack data.

[0015] Furthermore, according to the aforementioned dynamic trapping system based on distributed collaboration, the feature is that the bait management unit collaboratively manages bait nodes with different configurations and uses. It can issue and deploy low-interaction, medium-interaction, and high-interaction bait nodes with one click through the bait management interface. It can decouple bait nodes of different types and interaction levels. The decoupled bait nodes can deploy a certain number of security protection software to improve the simulation and deception of the bait. At the same time, the decoupled bait nodes can be dynamically added or deleted according to different application scenarios and hardware and software resources.

[0016] Further, according to the aforementioned distributed collaborative dynamic trapping system, the coordinator unit is characterized in that it can efficiently coordinate the collaborative work of the decoy management unit and the capture management unit. The coordinator unit handles all system events; it can monitor system events from decoy nodes and data capture nodes in real time, ensuring that inbound system events are assigned to the appropriate units for processing, and can generate response events to redirect malicious events to honeypot nodes with no practical value or directly perform source tracing and countermeasures. Simultaneously, the coordinator unit can also direct the interaction methods of the decoy management unit and the capture management unit, ensuring their collaborative work by scheduling their interface call sequences. Furthermore, the coordinator unit can guarantee that the decoy management unit and the capture management unit can be deployed, updated, and managed independently, realizing dynamic management requirements.

[0017] Further, according to the aforementioned dynamic decoy system based on distributed collaboration, the system is characterized in that the capture management unit coordinates and controls the data capture unit, the data control unit, and the data analysis unit. When attack data enters the decoy node, corresponding system events and attack log information are generated. The coordinator unit can monitor the event execution status of the honeypot in real time and record its system event and log changes. Once the coordinator unit detects new system events and log information, it sends a data capture command to the capture management unit. After receiving the data capture command sent by the coordinator unit, the capture management unit sends a command to the data capture unit to capture the corresponding decoy node log information. The capture management unit also sends data control and data analysis instructions to the data control unit and the data analysis unit respectively, controlling the data capture unit, the data control unit, and the data analysis unit to work collaboratively.

[0018] Furthermore, according to the aforementioned distributed collaborative dynamic decoy system, the data capture unit is the core module of the distributed collaborative dynamic decoy system, dedicated to capturing all intrusion events and malicious behaviors. The data capture unit focuses on capturing firewall logs (inbound and outbound connections), network traffic (data packets and payload information sent to decoy nodes), and system events (attack keylogging, system calls, and modified files, etc.), ensuring that the dynamic decoy system captures more comprehensive and higher-quality malicious attack data.

[0019] Further, according to the aforementioned distributed collaborative dynamic decoy system, the data control unit can counterattack attacks to a certain extent. It can forward attack traffic based on the honeypot node's intent, rather than executing attack events based on the attacker's intent. The data control unit can discard intrusion data streams that are not of interest to the dynamic decoy system and forward data of interest, even redirecting the most interesting data to dedicated decoy resources. Simultaneously, it can redirect malicious attack streams to other virtual nodes to prevent attackers from using compromised honeypots as springboards to attack other related systems. Furthermore, the data control unit can set a reasonable attack data discard threshold, ensuring the simulation and transparency of the honeypot node while collecting sufficient attack behaviors, and more importantly, ensuring the concealment and security of the real information system.

[0020] Furthermore, according to the aforementioned dynamic trapping system based on distributed collaboration, the data analysis unit utilizes mature automated analysis algorithms such as machine learning, deep learning, and graph neural networks to automatically analyze and mine the attack data captured by the data capture unit, revealing the attacker's attack intent, intrusion methods, attack tools, and attack profile of the attacker or organization. It can even conduct in-depth analysis to obtain more refined attack fingerprints of the attacker or attack organization, continuously expanding the attack fingerprint database of the dynamic trapping system, and providing important knowledge support for the system's source tracing, evidence collection, and countermeasures.

[0021] A method for a dynamic trapping system based on distributed cooperation, characterized by the following steps:

[0022] Step (1): Deploy the coordinator unit on the cloud server or local server and initialize the coordinator unit parameters, including: the number of decoy management units and capture management units, the control command issuance time and period, the feedback time and period of the decoy management units and capture management units, the status judgment of the decoy management units and capture management units, etc. According to the configuration information table of the coordinator unit, the dynamic expansion and management of the decoy manager and capture manager can be realized.

[0023] Step (2): Based on the configuration parameters of the coordinator unit, instantiate the decoy management unit. The decoy management unit can be deployed on the same or different servers as the coordinator unit, as long as they can communicate normally. The decoy management unit is mainly responsible for configuring the main information of all decoy nodes, including: the number of decoy nodes, communication address, running status, simulation, interactivity, simulation communication protocol, the number of security protection hardware and software, and whether it has redirection and countermeasure capabilities, etc. Step (3): Based on the decoy configuration parameters set by the decoy management unit in step (2), instantiate low-interaction, medium-interaction, and high-interaction decoy nodes in the cloud server, local server, or container, and establish permanent communication between the decoy nodes and the decoy management unit. Set a heartbeat mechanism in the decoy nodes to periodically send back the running status of the decoy nodes to the decoy management unit. Correspondingly, the decoy management unit periodically receives the running status of different decoy nodes. Once the decoy management unit does not receive the status information sent by the decoy node within three consecutive time delays, it restarts the decoy node to ensure that the decoy node is visible and controllable.

[0024] Step (4): Based on the coordinator unit configuration parameters in step (1), instantiate the capture management unit. The capture management unit instance can be deployed on the same or different servers as the coordinator unit. The capture management unit is responsible for configuring and managing the data control unit, data capture unit and data analysis unit downwards, and is responsible for periodically sending back the current running status of itself and its subordinate units to the coordinator unit, coordinating and managing the collaborative and orderly work of the data control unit, data capture unit and data analysis unit.

[0025] Step (5): The data control unit discards intrusion data streams that the dynamic decoy system is not interested in, or forwards uninteresting attack data streams to low-interaction honeypots, redirecting only the most interesting attack data streams to dedicated decoy resources. This ensures timely and accurate responses to attack packets, improving simulation and deception. Simultaneously, malicious attack streams are redirected to other virtual nodes to prevent attackers from using compromised honeypots as springboards to attack other related systems. Furthermore, the data control unit needs to set a reasonable attack data discard threshold to ensure the simulation and transparency of honeypot nodes while collecting sufficient attack behaviors, and more importantly, to ensure the concealment and security of the real information system.

[0026] Step (6): Use the data capture unit to capture firewall logs (inbound and outbound connections), network traffic (data packets and payload information sent to the decoy node), and system events (attack keylogging, system calls, and modified files, etc.). All system events, system logs, and malicious behaviors can ensure that the dynamic decoy system captures more comprehensive and higher quality malicious attack data.

[0027] Step (7): Utilize mature automated analysis algorithms and models such as machine learning, deep learning, and graph neural networks to automatically analyze and mine the system events, system logs, and attack data captured by the data capture unit. This reveals the attacker's attack intent, intrusion methods, attack tools, and the attack profile of the attacker or attack organization. In-depth analysis yields more refined attack fingerprints of the attacker or attack organization, continuously expanding the attack fingerprint database of the dynamic trapping system. This provides important knowledge support for the system's source tracing, evidence collection, and countermeasures. Based on the captured attack data, this patent can effectively detect advanced persistent attacks.

[0028] The beneficial effects of this invention are:

[0029] 1) This invention overcomes the drawback of the high coupling between the bait management unit and the data capture unit in traditional honeypot systems, and designs and implements a dynamic trapping system and method based on distributed collaboration. The decoupled bait management unit and data capture unit can release the capabilities of the capture management unit, enabling it to provide high-quality data capture services. At the same time, decoupling also brings benefits to the bait management unit, because once it is freed from the constraints of the data capture unit, the bait management unit can become more flexible and diverse.

[0030] 2) The honeypot system proposed in this invention can deploy a certain number of security protection hardware and software facilities in the decoupled decoy capture unit to ensure that it can more effectively simulate the real information system environment, thereby improving the simulation degree and deception of the honeypot.

[0031] 3) This invention can counterattack attacks to a certain extent. It can forward attack traffic according to the intent of the honeypot node, discard intrusion data streams that are not of interest to the dynamic trapping system and forward data that are of interest, and even redirect the most interesting data to dedicated decoy resources. At the same time, it can redirect malicious attack streams to other virtual nodes to prevent attackers from using compromised honeypots as springboards to attack other related systems. In addition, this invention can set a reasonable attack data discard threshold, which can collect enough attack behaviors while ensuring the simulation degree and transparency of the honeypot node, and ensuring the concealment and security of the real information system.

[0032] 4) Practical application using the prototype system has proven that this invention can effectively deceive and trap different types of attack behavior data, perfectly meeting the requirements of concealment, countermeasures, and dynamism in dynamic trapping systems. Furthermore, the solution described in this invention is easy to deploy in existing networks, simple to operate, and secure and reliable, demonstrating significant economic and social benefits and broad market application prospects. Attached Figure Description

[0033] Figure 1This is a block diagram of the overall structure of a dynamic trapping system based on distributed cooperation as described in this invention; (Framework diagram of a dynamic trapping system based on distributed cooperation) Detailed Implementation

[0034] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings, so that those skilled in the art can more clearly understand the solution of the present invention, but this does not limit the scope of protection of the present invention.

[0035] Initially, network design prioritized the convenience and speed of information exchange, with limited consideration for information security and planning. However, with the rapid development of mobile internet and smart terminals, cyberattacks have become increasingly rampant. Furthermore, the inherent openness and interconnectivity of networks have transformed into cybersecurity vulnerabilities as attack and defense technologies have evolved. Cyberattacks have impacted daily life, such as hackers stealing bank passwords and controlling smart home devices. Currently, increasingly sophisticated attack methods permeate cyberspace, rendering existing static signature-based protection strategies ineffective. Therefore, proactive security defense technologies based on dynamic deception have significant practical implications. Honeypots are a proactive defense technology introduced by defenders to address the asymmetry in network attack and defense. By deploying hardware and software resources without business applications, attackers are tricked into scanning, probing, and attacking these resources, allowing for the capture and analysis of attack behavior, understanding attack tools and methods, and inferring attack intentions and motives. Honeypot technology has gained sustained attention from the security community, achieving significant development and widespread application, and has become a primary technical means for monitoring and analyzing internet security threats. This invention comprehensively considers the advantages and disadvantages of many honeypot trapping systems and proposes a dynamic trapping system and method based on distributed collaboration, which effectively realizes comprehensive malicious attack log collection and meets the requirements of dynamic trapping systems in terms of sensitivity, countermeasures, concealment and dynamism.

[0036] First, the technical innovation principle of this invention is explained. Its basic idea is as follows: The bait management unit and data capture unit of a traditional honeypot are decoupled. A resource management unit is introduced to coordinate and manage the decoupled bait management unit and data capture unit. The decoupled bait management unit can deploy a certain number of security protection facilities simultaneously with the bait deployment to improve the bait's realism and more effectively deceive attackers. The decoupled data capture unit deploys more refined data acquisition, data control, and data analysis functions to achieve real-time data analysis. Furthermore, each decoupled unit can be deployed and updated independently and can be flexibly combined according to different scenarios and methods to effectively achieve comprehensive malicious attack log collection, meeting the sensitivity, countermeasures, concealment, and dynamism requirements of a dynamic baiting system.

[0037] The distributed collaborative dynamic trapping system described in this invention, such as... Figure 1 As shown, users only need to perform the following steps to implement the dynamic trapping system designed in this invention and capture data on different malicious attack behaviors: 1) Deploy the coordinator unit on a cloud server or local server and initialize the coordinator unit parameters, including: the number of decoy management units and capture management units, the control command issuance time and period, the feedback time and period of the decoy management units and capture management units, and the status judgment of the decoy management units and capture management units; 2) Based on the configuration parameters of the coordinator unit, instantiate the decoy management unit. The decoy management unit is mainly responsible for configuring the main information of all decoy nodes, including: the number of decoy nodes, communication address, running status, simulation capability, interactivity, simulation communication protocol, the number of security protection software and hardware, and whether it has heavy... Targeting and countermeasure capabilities, etc.; 3) Instantiate low-interaction, medium-interaction, and high-interaction decoy nodes in cloud servers, local servers, or containers, and establish permanent communication between the decoy nodes and the decoy management unit, and set a heartbeat mechanism in the decoy nodes to periodically send back the running status of the decoy nodes to the decoy management unit; (4) Instantiate the capture management unit, which is responsible for configuring and managing the data control unit, data capture unit, and data analysis unit downwards, and is responsible for periodically sending back the current running status of itself and its subordinate units to the coordinator unit upwards, and coordinating and managing the coordinated and orderly operation of the data control unit, data capture unit, and data analysis unit. 5) Discard intrusion data streams that are not of interest to the dynamic trapping system or forward uninteresting attack data streams to low-interaction honeypots, redirecting only the most interesting attack data streams to dedicated decoy resources to ensure timely and accurate responses to attack packets, improving simulation and deception. In addition, the data control unit needs to set a reasonable attack data discard threshold to ensure the simulation and transparency of honeypot nodes while collecting enough attack behaviors, and more importantly, to ensure the concealment and security of real information systems; 6) Use the data capture unit to capture firewall logs, network traffic, system events, and malicious behaviors to ensure that the dynamic trapping system captures more comprehensive and higher-quality malicious attack data; 7) Use mature automated analysis algorithms and models such as machine learning, deep learning, and graph neural networks to automatically analyze and mine the attack data captured by the data capture unit, revealing the attacker's attack intent, intrusion methods, attack tools, and attack profiles of attackers or attack organizations, and conduct in-depth analysis to obtain more refined attack fingerprints of attackers or attack organizations, continuously expanding the attack fingerprint database of the dynamic trapping system, providing important knowledge support for system tracing, evidence collection, and countermeasures. Based on the captured attack data, this patent can effectively detect advanced persistent attacks.

[0038] This invention focuses on the stealth, countermeasures, and dynamism requirements of dynamic decoy systems, proposing a distributed collaborative dynamic decoy system and method. It addresses the drawback of high coupling between the decoy management unit and the data capture unit by introducing a regulator unit to coordinate and manage their collaborative operation. The decoupled units can be deployed and updated independently, facilitating management and maintenance. Furthermore, this invention classifies attack traffic data, forwarding only traffic of interest to the dynamic decoy system to corresponding high-interaction honeypots, saving hardware and software resources while improving the collection of relevant attack data. As mentioned earlier, the distributed collaborative dynamic decoy system proposed in this invention can deploy varying numbers of security protection software on decoy nodes, enhancing their deceptiveness. Simultaneously, the data control unit involved in this invention can transfer attack flows of interest to highly interactive honeypots, significantly improving resource utilization. Furthermore, besides focusing on real-time dynamic capture of attack data, this invention also emphasizes the analysis and mining of attack data, revealing the attacker's intent, intrusion methods, attack tools, and attack profiles of the attacker or attack organization. In-depth analysis yields more refined attack fingerprints of the attacker or attack organization, continuously expanding the attack fingerprint database of the dynamic decoy system. This provides crucial knowledge support for system tracing, evidence collection, and countermeasures. Based on the captured attack data, this patent can effectively detect advanced persistent attacks. Finally, practical application using a prototype system has proven that this invention can effectively detect malware, especially well-disguised and stealthy malware. Moreover, the solution described in this invention is easy to deploy in existing networks, simple to operate, secure, and reliable, possessing significant economic and social benefits and broad market application prospects.

[0039] The structure, principle, and working process of the distributed collaborative dynamic trapping system and method of the present invention are described in detail below with reference to the accompanying drawings. Preferred embodiments include the following.

[0040] Preferred Implementation

[0041] like Figure 1 As shown, in a preferred embodiment, the distributed collaborative dynamic trapping system of the present invention includes a bait management unit, a capture management unit, a coordinator unit, a data capture unit, a data control unit, and a data analysis unit.

[0042] The decoy management unit collaboratively manages decoy nodes with different configurations and uses. It can issue and deploy low-interaction, medium-interaction, and high-interaction decoy nodes with one click through the decoy management interface. It can decouple decoy nodes of different types and levels of interaction. The decoupled decoy nodes can deploy a certain number of security protection software to improve the simulation and deception of the decoys. At the same time, the decoupled decoy nodes can be dynamically added or deleted according to different application scenarios and software and hardware resources.

[0043] The coordinator unit efficiently coordinates the collaborative work of the decoy management unit and the capture management unit. The coordinator unit handles all system events, monitoring system events from decoy nodes and data capture nodes in real time to ensure that inbound system events are assigned to the appropriate units for processing. It can also generate response events to redirect malicious events to honeypot nodes with no practical value or directly perform source tracing and countermeasures. Simultaneously, the coordinator unit can direct the interaction between the decoy management unit and the capture management unit, ensuring their collaborative operation by scheduling their interface call sequences. Furthermore, the coordinator unit guarantees that the decoy management unit and the capture management unit can be deployed, updated, and managed independently, fulfilling dynamic management requirements.

[0044] The capture management unit coordinates and controls the data capture unit, data control unit, and data analysis unit. When attack data enters the decoy node, corresponding system events and attack log information are generated. The coordinator unit can monitor the event execution status of the honeypot in real time and record its system event and log changes. Once the coordinator unit detects new system events and log information, it sends a data capture command to the capture management unit. After receiving the data capture command from the coordinator unit, the capture management unit issues a command to the data capture unit to capture the corresponding decoy node log information. The capture management unit also sends data control and data analysis instructions to the data control unit and data analysis unit respectively, controlling the data capture unit, data control unit, and data analysis unit to work together.

[0045] The data capture unit is the core module of the distributed collaborative dynamic decoy system, dedicated to capturing all intrusion events and malicious behaviors. The data capture unit focuses on capturing firewall logs (inbound and outbound connections), network traffic (data packets and payload information sent to decoy nodes), and system events (attack keylogging, system calls, and modified files, etc.), ensuring that the dynamic decoy system captures more comprehensive and higher-quality malicious attack data.

[0046] The data control unit can counterattack attacks to a certain extent. It can forward attack traffic based on the honeypot node's intent, rather than executing attack events based on the attacker's intent. The data control unit can discard intrusion data streams that are not of interest to the dynamic decoy system and forward data that is of interest, even redirecting the most relevant data to dedicated decoy resources. Simultaneously, it can redirect malicious attack streams to other virtual nodes to prevent attackers from using compromised honeypots as springboards to attack other related systems. Furthermore, the data control unit can set a reasonable attack data discard threshold, ensuring the simulation and transparency of the honeypot node while collecting sufficient attack behavior data, and more importantly, ensuring the concealment and security of the real information system.

[0047] The data analysis unit utilizes mature automated analysis algorithms such as machine learning, deep learning, and graph neural networks to automatically analyze and mine the attack data captured by the data capture unit. This reveals the attacker's attack intent, intrusion methods, attack tools, and attack profile of the attacker or organization. It can even conduct in-depth analysis to obtain more refined attack fingerprints of the attacker or organization, continuously expanding the attack fingerprint database of the dynamic trapping system and providing important knowledge support for the system's source tracing, evidence collection, and countermeasures.

[0048] In this way, when an attacker scans, probes, or attacks a decoy node system on the Internet, the coordinator unit will perceive the system events and log information of the decoy node in real time. The coordinator unit will then issue a data capture command to the capture management unit, which in turn sends a command to the data control unit. The data control unit will then classify the attack data according to the capture management command, migrating the attack data streams of interest to the decoy system to low-interaction honeypots and redirecting the attack traffic of interest to high-interaction honeypots. It will also notify the data capture unit to record system events, logs, and attack behavior data in the high-interaction honeypots. Finally, the data analysis unit will conduct in-depth analysis and mining of the attack data captured by the data capture unit, providing data support for subsequent protection decisions. This invention can effectively capture different types of network attack behaviors and efficiently achieve proactive network security protection.

[0049] This invention further proposes a dynamic trapping method based on distributed cooperation, comprising the following steps:

[0050] Step (1): Deploy the coordinator unit on the cloud server or local server and initialize the coordinator unit parameters, including: the number of decoy management units and capture management units, the control command issuance time and period, the feedback time and period of the decoy management units and capture management units, the status judgment of the decoy management units and capture management units, etc. According to the configuration information table of the coordinator unit, the dynamic expansion and management of the decoy manager and capture manager can be realized.

[0051] Step (2): Based on the configuration parameters of the coordinator unit, instantiate the decoy management unit. The decoy management unit can be deployed on the same or different servers as the coordinator unit, as long as they can communicate normally. The decoy management unit is mainly responsible for configuring the main information of all decoy nodes, including: the number of decoy nodes, communication address, running status, simulation, interactivity, simulation communication protocol, the number of security protection hardware and software, and whether it has redirection and countermeasure capabilities, etc. Step (3): Based on the decoy configuration parameters set by the decoy management unit in step (2), instantiate low-interaction, medium-interaction, and high-interaction decoy nodes in the cloud server, local server, or container, and establish permanent communication between the decoy nodes and the decoy management unit. Set a heartbeat mechanism in the decoy nodes to periodically send back the running status of the decoy nodes to the decoy management unit. Correspondingly, the decoy management unit periodically receives the running status of different decoy nodes. Once the decoy management unit does not receive the status information sent by the decoy node within three consecutive time delays, it restarts the decoy node to ensure that the decoy node is visible and controllable.

[0052] Step (4): Based on the coordinator unit configuration parameters in step (1), instantiate the capture management unit. The capture management unit instance can be deployed on the same or different servers as the coordinator unit. The capture management unit is responsible for configuring and managing the data control unit, data capture unit and data analysis unit downwards, and is responsible for periodically sending back the current running status of itself and its subordinate units to the coordinator unit, coordinating and managing the collaborative and orderly work of the data control unit, data capture unit and data analysis unit.

[0053] Step (5): The data control unit discards intrusion data streams that the dynamic decoy system is not interested in, or forwards uninteresting attack data streams to low-interaction honeypots, redirecting only the most interesting attack data streams to dedicated decoy resources. This ensures timely and accurate responses to attack packets, improving simulation and deception. Simultaneously, malicious attack streams are redirected to other virtual nodes to prevent attackers from using compromised honeypots as springboards to attack other related systems. Furthermore, the data control unit needs to set a reasonable attack data discard threshold to ensure the simulation and transparency of honeypot nodes while collecting sufficient attack behaviors, and more importantly, to ensure the concealment and security of the real information system.

[0054] Step (6): Use the data capture unit to capture firewall logs (inbound and outbound connections), network traffic (data packets and payload information sent to the decoy node), and system events (attack keylogging, system calls, and modified files, etc.). All system events, system logs, and malicious behaviors can ensure that the dynamic decoy system captures more comprehensive and higher quality malicious attack data.

[0055] Step (7): Utilize mature automated analysis algorithms and models such as machine learning, deep learning, and graph neural networks to automatically analyze and mine the system events, system logs, and attack data captured by the data capture unit. This reveals the attacker's attack intent, intrusion methods, attack tools, and the attack profile of the attacker or attack organization. In-depth analysis yields more refined attack fingerprints of the attacker or attack organization, continuously expanding the attack fingerprint database of the dynamic trapping system. This provides important knowledge support for the system's source tracing, evidence collection, and countermeasures. Based on the captured attack data, this patent can effectively detect advanced persistent attacks.

[0056] The above description is merely of preferred embodiments of the present invention and does not limit the technical solution of the present invention to this. Any known modifications made by those skilled in the art based on the main technical concept of the present invention shall fall within the technical scope to be protected by the present invention. The specific protection scope of the present invention shall be determined by the claims.

Claims

1. A dynamic trapping system based on distributed cooperation, characterized in that, include: The system includes a decoy management unit, a capture management unit, a coordinator unit, a data capture unit, a data control unit, and a data analysis unit. The decoy management unit collaboratively manages decoy nodes with different configurations and uses. It can issue and deploy low-interaction, medium-interaction, and high-interaction decoy nodes with one click through the decoy management interface, decoupling decoy nodes of different types and levels of interaction. After decoupling, a certain number of security protection software are deployed on the decoy nodes to improve the simulation and deception of the decoys. At the same time, the decoupling decoy nodes can be dynamically added or deleted according to different application scenarios and hardware and software resources. The coordinator unit coordinates the collaborative work of the decoy management unit and the capture management unit; The coordinator unit handles all system events, listens for system events from decoy nodes and data capture nodes in real time, ensures that inbound system events are assigned to the appropriate units for processing, and can generate response events to redirect malicious events to honeypot nodes with actual value or directly trace and counteract them; at the same time, the coordinator unit can also direct the interaction mode of the decoy management unit and the capture management unit, and ensure that the decoy management unit and the capture management unit can work together by scheduling their interface call sequence. In addition, the coordinator unit ensures that the decoy management unit and the capture management unit can be deployed, updated and managed independently to meet dynamic management requirements; The capture management unit coordinates and controls the data capture management unit, data control unit, and data analysis unit. When attack data enters the decoy node, it generates corresponding system events and attack log information. The coordinator unit can monitor the event execution status of the honeypot in real time and record its system events and log changes. Once the coordinator unit detects new system events and log information, it sends a data capture command to the capture management unit. After receiving the data capture command from the coordinator unit, the capture management unit issues a command to capture the corresponding decoy node log information. The capture management unit also sends data control and data analysis instructions to the data control unit and data analysis unit respectively, controlling the data capture unit, data control unit, and data analysis unit to work together.

2. The dynamic trapping system based on distributed cooperation according to claim 1, characterized in that, The data capture unit is the core module of the distributed collaborative dynamic trapping system, dedicated to capturing all intrusion events and malicious behaviors; the data capture unit focuses on capturing firewall logs, network traffic and system events.

3. The dynamic trapping system based on distributed cooperation according to claim 1, characterized in that, The data control unit counteracts attacks to a certain extent by forwarding attack traffic based on the honeypot node's intent, rather than executing attack events based on the attacker's intent. The data control unit can discard intrusion data streams that the dynamic decoy system is not interested in and forward data that is of interest, even redirecting the most interesting data to dedicated decoy resources. Simultaneously, it redirects malicious attack streams to other virtual nodes to prevent attackers from using compromised honeypots as springboards to attack other related systems. Furthermore, the data control unit can set a reasonable attack data discard threshold, ensuring the simulation and transparency of the honeypot node while collecting attack information, thus ensuring the concealment and security of the real information system.

4. The dynamic trapping system based on distributed cooperation according to claim 1, characterized in that, The data analysis unit utilizes mature automated analysis algorithms such as machine learning, deep learning, and graph neural networks to automatically analyze and mine the attack data captured by the data capture unit. This reveals the attacker's attack intent, intrusion methods, attack tools, and attack profile of the attacker or organization. It can even conduct in-depth analysis to obtain refined attack fingerprints of the attacker or attack organization, continuously expanding the attack fingerprint database of the dynamic trapping system and providing important knowledge support for the system's source tracing, evidence collection, and countermeasures.

5. A dynamic trapping method based on distributed cooperation, characterized in that, Includes the following steps: Step (1): Deploy the coordinator unit on the cloud server or local server and initialize the coordinator unit parameters, including: the number of decoy management units and capture management units, the control command issuance time and period, the feedback time and period of the decoy management units and capture management units, the status judgment information of the decoy management units and capture management units, and realize the dynamic expansion and management of the decoy manager and capture manager according to the configuration information table of the coordinator unit. Step (2): Based on the configuration parameters of the coordinator unit, instantiate the decoy management unit. The decoy management unit and the coordinator unit are deployed on the same or different servers to ensure that they can communicate normally. The decoy management unit is mainly responsible for configuring the main information of all decoy nodes, including: the number of decoy nodes, communication address, running status, simulation, interactivity, simulation communication protocol, number of security protection software and hardware, and whether it has redirection and countermeasure capabilities. Step (3): Based on the bait configuration parameters set by the bait management unit in step (2), instantiate low-interaction, medium-interaction, and high-interaction bait nodes in the cloud server, local server, or container, and establish permanent communication between the bait nodes and the bait management unit. Set a heartbeat mechanism in the bait nodes to periodically send back the running status of the bait nodes to the bait management unit. Correspondingly, the bait management unit periodically receives the running status of different bait nodes. Once the bait management unit does not receive the status information sent by the bait node within three consecutive time delays, it restarts the bait node to ensure that the bait nodes are visible and controllable. Step (4): Based on the coordinator unit configuration parameters in step (1), instantiate the capture management unit. The capture management unit instance is deployed on the same or different server as the coordinator unit. The capture management unit is responsible for configuring and managing the data control unit, data capture unit and data analysis unit downwards, and is responsible for periodically sending back the current running status of itself and its subordinate units to the coordinator unit upwards, coordinating and managing the collaborative and orderly work of the data control unit, data capture unit and data analysis unit. Step (5): The data control unit discards intrusion data streams that are not of interest to the dynamic decoy system or forwards uninterested attack data streams to low-interaction honeypots, and redirects only the most interesting attack data streams to dedicated decoy resources to ensure timely and accurate responses to attack messages, thereby improving simulation and deception. At the same time, malicious attack streams are redirected to other virtual nodes to prevent attackers from using compromised honeypots as springboards to attack other related systems. In addition, the data control unit needs to set a reasonable attack data discard threshold to ensure the simulation and transparency of honeypot nodes while collecting attack behavior, and more importantly, to ensure the concealment and security of real information systems. Step (6): Use the data capture unit to capture firewall logs, network traffic and system events. All system events, system logs and malicious behaviors are captured to ensure that the malicious attack data captured by the dynamic trapping system is more comprehensive. Step (7): Utilize mature automated analysis algorithms and models such as machine learning, deep learning, and graph neural networks to automatically analyze and mine system events, system logs, and attack data captured by the data capture unit. This will reveal the attacker's attack intent, intrusion methods, attack tools, and attack profile of the attacker or attack organization. In-depth analysis will yield more refined attack fingerprints of the attacker or attack organization, continuously expanding the attack fingerprint database of the dynamic trapping system and providing important knowledge support for the system's source tracing, evidence collection, and countermeasures.

Images